Effective date: 2026-08-11 · Version 1.0
This Leads Data Processing Addendum ("Leads DPA") governs Backstory's processing of leads' business contact data (named individuals at accounts Customer has identified) through the optional Contacts add-on, and supplements the Terms of Service between you ("Customer", "Controller") and Backstory Pty Ltd ("Backstory", "Processor"). It is separate from, and in addition to, the Core DPA that covers Backstory's Core (company-level, no-PII) analytics product.
Contacts is opt-in. An organization must accept this Leads DPA — recorded against the organization's account, with the accepted version tracked so a future material update requires re-acceptance — before any lead preview or reveal is available.
For all processing under this DPA, Customer is the data controller and Backstory is the data processor. Backstory processes lead data solely to provide the Contacts feature to Customer, using a third-party lead-data provider (currently GetProspect) as our sub-processor.
Subject matter: discovery and reveal of leads (named individuals: name, business email, job title, LinkedIn URL) employed at companies Backstory's Core product has identified as visiting Customer's website, matched against Customer's configured target job titles.
Duration: for as long as Customer's Contacts add-on is active, plus the retention period in Section 7.
Nature: real-time API lookups against our lead-data sub-processor, on Customer's instruction (triggered by Customer's own preview/reveal actions in the product), plus storage of revealed records in a data store isolated from Core analytics data.
Purpose: enabling Customer's own B2B sales and marketing outreach to individuals at companies who have shown buying intent on Customer's website.
Data subjects: leads (individual employees) at companies identified by Backstory's Core product, matched to Customer's target job titles.
Categories of personal data: full name, business email address, job title, employer/company, and (where available) LinkedIn profile URL. No special-category data (Article 9 GDPR) is processed.
Backstory will:
Customer is responsible for having a lawful basis for its own outreach to individuals surfaced through Contacts (e.g. legitimate interest for B2B marketing under GDPR, or the applicable basis under the Privacy Act/CCPA/anti-spam law), for honoring deletion/opt-out/access requests it receives directly from those individuals, and for using Contacts data only for its own sales/marketing purposes, not for resale. See our Acceptable Use Policy.
Revealed lead records are retained for the lifetime of Customer's Contacts subscription unless Customer deletes them earlier. On written request (support@trybackstory.com) or account/add-on termination, Backstory will delete Contacts data within 30 days, except where retention is required by law.
Backstory's lead-data sub-processor may process data outside the EEA/UK. Where this occurs without an applicable adequacy decision, the parties agree that the EU Standard Contractual Clauses (Module 2: Controller to Processor), and, for transfers subject to UK GDPR, the UK International Data Transfer Addendum (IDTA), are incorporated into this Leads DPA by reference as Annex A and Annex B respectively. Copies are available on request from legal@trybackstory.com and will be countersigned for Customers who require an executed copy rather than click-through acceptance.
Annex A — EU SCCs: Module 2 (Controller-to-Processor) of the SCCs approved by European Commission Implementing Decision (EU) 2021/914, with Backstory as "data importer" processor and Customer as "data exporter" controller; Annex I (parties/description of processing) is populated by Sections 2–4 of this DPA; Annex II (technical and organizational measures) is populated by Core DPA Section 6.
Annex B — UK IDTA: the UK Information Commissioner's Office International Data Transfer Addendum to the EU SCCs (Version B1.0), incorporating the Annex A SCCs for transfers subject to UK GDPR.
This list is additive to, and does not replace, the Core sub-processor list at Sub-processor list (which covers infrastructure shared by both Core and Contacts, e.g. hosting and database).
Liability under this Leads DPA is governed by the limitation-of-liability provisions of the Terms of Service. This DPA remains in effect for as long as Backstory processes Contacts data on Customer's behalf, and is governed by the laws of Australia, except that Annex A/Annex B are governed by their own terms as required by EU/UK law.
Questions about this Leads DPA: legal@trybackstory.com.